All Apps and Add-ons

How to index errors and exceptions in case of connection problem to remote host

Explorer

Hi!
I’m getting the following errors in results of query:

>index=_internal ExecProcessor error rest.py

06-01-2018 14:56:19.657 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" Exception performing request: HTTPConnectionPool(host='test-host.ru', port=9080): Max retries exceeded with url: /config/healthcheck (Caused by <class 'socket.error'>: [Errno 111] Connection refused)

But when I execute the query:

index="test_2" | spath | timechart span=30s count by body

I have a response which successfully executed without errors. I have to index errors for a future reflection on my dashboard.

In properties set of a rest data input I've checked the checkbox: “Index Error Responses” (Whether or not to index error response codes, defaults to false). No luck
How can I get the errors in my index test_2?

0 Karma

SplunkTrust
SplunkTrust

Well, I won't answer this so the app creator can chime in or fix that option, but for now, one thing you could do as a workaround...

index="test_2" OR (index=_internal ExecProcessor error rest.py) ....

That should just make those show up in the search directly.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!